From 822b09c8e1fcb3d7ca8aab04a352320fb96d227c Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Fri, 30 May 2014 21:34:05 -0700
Subject: [PATCH] Specifically allow only local frames, as Chrome on iOS
 doesn't load framesets without this http://virtualmin.com/node/33332

---
 web-lib-funcs.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web-lib-funcs.pl b/web-lib-funcs.pl
index e940c94f8..3bfdd17d1 100755
--- a/web-lib-funcs.pl
+++ b/web-lib-funcs.pl
@@ -754,7 +754,7 @@ if (!$gconfig{'no_frame_options'}) {
 	print "X-Frame-Options: SAMEORIGIN\n";
 	}
 if (!$gconfig{'no_content_security_policy'}) {
-	print "Content-Security-Policy: script-src 'self' 'unsafe-inline'\n";
+	print "Content-Security-Policy: script-src 'self' 'unsafe-inline'; frame-src 'self'\n";
 	}
 if (defined($_[0])) {
 	print "Content-type: text/html; Charset=$_[0]\n\n";